Symantec ALTIRIS OUT OF BAND MANAGEMENT COMPONENT 7.0 SP3 -... User manual

Altiris™Out of Band
Management Component
from Symantec
Implementation Guide
Version 7.0 SP3 MR1

Altiris™Out of Band Management Component from
Symantec Implementation Guide
The software described in this book is furnished under a license agreement and may be used
only in accordance with the terms of the agreement.
Documentation version 7.0 SP3 MR1
Legal Notice
Copyright © 2010 Symantec Corporation. All rights reserved.
Symantec, the Symantec Logo, Altiris, and any Altiris or Symantec trademarks used in the
product are trademarks or registered trademarks of Symantec Corporation or its affiliates
in the U.S. and other countries. Other names may be trademarks of their respective owners.
The product described in this document is distributed under licenses restricting its use,
copying, distribution, and decompilation/reverse engineering. No part of this document
may be reproduced in any form by any means without prior written authorization of
Symantec Corporation and its licensors, if any.
THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS,
REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT,
ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO
BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL
OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING,
PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED
IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.
The Licensed Software and Documentation are deemed to be commercial computer software
as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19
"Commercial Computer Software - Restricted Rights" and DFARS 227.7202, "Rights in
Commercial Computer Software or Commercial Computer Software Documentation", as
applicable, and any successor regulations. Any use, modification, reproduction release,
performance, display or disclosure of the Licensed Software and Documentation by the U.S.
Government shall be solely in accordance with the terms of this Agreement.
Symantec Corporation
350 Ellis Street
Mountain View, CA 94043
http://www.symantec.com

Technical Support
Symantec Technical Support maintains support centers globally. Technical
Support’s primary role is to respond to specific queries about product features
and functionality. The Technical Support group also creates content for our online
Knowledge Base. The Technical Support group works collaboratively with the
other functional areas within Symantec to answer your questions in a timely
fashion. For example, the Technical Support group works with Product Engineering
and Symantec Security Response to provide alerting services and virus definition
updates.
Symantec’s support offerings include the following:
■A range of support options that give you the flexibility to select the right
amount of service for any size organization
■Telephone and/or Web-based support that provides rapid response and
up-to-the-minute information
■Upgrade assurance that delivers software upgrades
■Global support purchased on a regional business hours or 24 hours a day, 7
days a week basis
■Premium service offerings that include Account Management Services
For information about Symantec’s support offerings, you can visit our Web site
at the following URL:
www.symantec.com/business/support/
All support services will be delivered in accordance with your support agreement
and the then-current enterprise technical support policy.
Contacting Technical Support
Customers with a current support agreement may access Technical Support
information at the following URL:
www.symantec.com/business/support/
Before contacting Technical Support, make sure you have satisfied the system
requirements that are listed in your product documentation. Also, you should be
at the computer on which the problem occurred, in case it is necessary to replicate
the problem.
When you contact Technical Support, please have the following information
available:
■Product release level

■Hardware information
■Available memory, disk space, and NIC information
■Operating system
■Version and patch level
■Network topology
■Router, gateway, and IP address information
■Problem description:
■Error messages and log files
■Troubleshooting that was performed before contacting Symantec
■Recent software configuration changes and network changes
Licensing and registration
If your Symantec product requires registration or a license key, access our technical
support Web page at the following URL:
www.symantec.com/business/support/
Customer service
Customer service information is available at the following URL:
www.symantec.com/business/support/
Customer Service is available to assist with non-technical questions, such as the
following types of issues:
■Questions regarding product licensing or serialization
■Product registration updates, such as address or name changes
■General product information (features, language availability, local dealers)
■Latest information about product updates and upgrades
■Information about upgrade assurance and support contracts
■Information about the Symantec Buying Programs
■Advice about Symantec's technical support options
■Nontechnical presales questions
■Issues that are related to CD-ROMs or manuals

Support agreement resources
If you want to contact Symantec regarding an existing support agreement, please
contact the support agreement administration team for your region as follows:
[email protected]Asia-Pacific and Japan
[email protected]Europe, Middle-East, and Africa
[email protected]North America and Latin America

Technical Support ............................................................................................... 3
Chapter 1 Introducing Out of Band Management
Component ..................................................................... 13
About Out of Band Management Component ..................................... 13
About out-of-band management ............................................... 14
About supported out-of-band management technologies ............... 14
Altiris products that can manage computers out of band ............... 15
What’s new in Out of Band Management Component .......................... 15
How Out of Band Management Component works .............................. 15
About the Symantec Management Console .................................. 16
About Intel AMT .................................................................... 16
About Intel AMT Setup and Configuration Service ....................... 17
About Intel AMT versions and features ...................................... 17
About Intel AMT configuration modes ....................................... 18
About Intel AMT security ........................................................ 20
About Intel AMT related credentials .......................................... 22
About Intel AMT wireless support ............................................. 24
About ASF ............................................................................ 24
About DASH .......................................................................... 25
Comparison of Intel AMT, ASF, and DASH .................................. 25
What you can do with Out of Band Management Component ................ 26
About Intel AMT tasks ............................................................ 26
About ASF tasks ..................................................................... 27
About DASH tasks .................................................................. 27
Where to get more information ....................................................... 27
Chapter 2 Planning for Out of Band Management Component
installation ...................................................................... 31
About environment requirements ................................................... 32
About configuring DNS ................................................................. 33
About configuring DHCP ............................................................... 34
About configuring SQL server ........................................................ 34
About integrating with Microsoft Active Directory ............................. 35
About installing Microsoft IIS ......................................................... 36
Contents

Installing and configuring CA ......................................................... 36
About installing .NET Framework on an OOB site server ...................... 38
About planning OOB site servers hierarchy ....................................... 38
Configuring a firewall to allow Intel SCS and SQL server
connections .......................................................................... 39
About ports used by Intel AMT ....................................................... 40
About installing Out of Band Management Component in a lab
environment ......................................................................... 40
About managing Intel AMT computers without the Altiris Agent
installed ............................................................................... 41
Chapter 3 Installing Out of Band Management
Component ..................................................................... 43
System requirements .................................................................... 43
About Out of Band Management Component requirements ............ 43
About client computer software and hardware
requirements .................................................................. 44
Installing the Out of Band Management Component product ................ 45
Upgrading the Out of Band Management Component product .............. 45
Uninstalling Out of Band Management Component ............................ 45
Uninstalling the Out of Band Task Agent .................................... 46
Uninstalling Out of Band Management Component from
Notification Server ........................................................... 47
Chapter 4 Preparing target computers for management .............. 49
Preparing target computers for management .................................... 49
Discovering computers ........................................................... 51
Installing the Altiris Agent ...................................................... 51
Configuring the Altiris Agent settings for evaluation use ............... 52
Discovering out-of-band capable computers ................................ 52
Installing the Out of Band Task Agent ........................................ 53
Chapter 5 Configuring Out of Band Management
Component ..................................................................... 55
Integrating Intel SCS with Active Directory ....................................... 55
Contents8

Chapter 6 Configuring Intel AMT computers for out-of-band
management .................................................................. 57
About configuring Intel AMT computers for out-of-band
management ......................................................................... 57
About Intel AMT initialization .................................................. 58
About Intel AMT setup and configuration ................................... 59
Prerequisites for Intel AMT configuration ........................................ 61
Configuring Intel AMT computers for out-of-band management ........... 61
Creating Intel AMT configuration profiles .................................. 62
Configuring the automatic Intel AMT configuration profile
assignment ..................................................................... 64
Initializing Intel AMT computers using the Remote Configuration
feature ........................................................................... 65
Initializing Intel AMT computers manually ................................ 76
Setting up and configuring initialized Intel AMT computers .......... 82
About resending Hello messages ..................................................... 89
Resending Hello messages with the Delayed Configuration
policy ............................................................................. 89
Resending Hello messages with the Send Intel AMT Hello
Message task ................................................................... 90
Configuring Intel AMT computers in small business mode ................... 91
Chapter 7 Configuring TLS ................................................................... 95
About TLS .................................................................................. 95
About configuring and enabling TLS ................................................ 95
Configuring TLS .......................................................................... 96
Exporting the CA Root Certificate for the Altiris Real-Time
System Manager software .................................................. 97
Configuring the connection profile to use TLS ............................. 97
Configuring Intel AMT computers to use TLS .............................. 98
Configuring TLS with mutual authentication ................................... 100
Creating and installing a client certificate using an Enterprise
CA ............................................................................... 100
Configuring Intel AMT computers to use TLS mutual
authentication ............................................................... 108
Chapter 8 Configuring ASF/DASH computers for out-of-band
management ................................................................. 111
Configuring ASF/DASH computers for out-of-band
management ....................................................................... 111
Installing the Broadcom ASF management software ................... 113
9Contents

Collecting ASF/DASH configuration and hardware
inventory ...................................................................... 113
Configuring ASF/DASH computers for out-of-band
management ................................................................. 115
What to do next ......................................................................... 115
Chapter 9 Deploying OOB site servers ............................................. 117
About site services ...................................................................... 117
About OOB site servers ................................................................ 118
Prerequisites for OOB site server installation ................................... 118
Installing an OOB site server ........................................................ 119
Viewing potential OOB site server computers ............................ 119
Configuring the OOB site server installation settings .................. 120
Rolling out the OOB site server ............................................... 120
Uninstalling an OOB site server .................................................... 121
Configuring the default OOB site server location .............................. 122
Chapter 10 About Out of Band Management Component
pages .............................................................................. 123
Auxiliary profiles: 802.1x Profiles page ........................................... 124
802.1x Profiles: Add 802.1x Profile dialog box ............................ 124
Select Certificate Generation Properties dialog box ..................... 126
Add Certificate Generation Properties dialog box ....................... 126
Select Certificate Template dialog box ...................................... 127
Auxiliary profiles: Management Presence Servers page ..................... 127
Management Presence Servers: Add Management Presence Server
dialog box ..................................................................... 127
Auxiliary profiles: Remote Access Policies page ............................... 128
Remote Access Policies: Create Remote Policy dialog box ............. 129
Auxiliary Profiles: Wireless Profiles page ........................................ 130
Wireless Profiles: Add Wireless Profile dialog box ...................... 130
Trusted Root Certificates page ...................................................... 131
Trusted Root Certificates: Select a Certificate Authority dialog
box .............................................................................. 131
Trusted Root Certificates: Import Trusted Root Certificate dialog
box .............................................................................. 131
Configuration Profiles page .......................................................... 131
Setup and configuration profile: General tab ............................. 131
Setup and configuration profile: Network tab ............................ 133
Setup and configuration profile: TLS tab .................................. 135
Setup and configuration profile: ACL tab .................................. 137
Setup and configuration profile: Wireless Profiles tab ................. 138
Contents10

Setup and configuration profile: Power Policy tab ....................... 139
Setup and configuration profile: Domains tab ............................ 140
Setup and configuration profile: Remote Access tab .................... 141
DNS configuration page ............................................................... 142
General page ............................................................................. 142
Select Active Directory Organizational Unit dialog box ................ 144
Maintenance page ...................................................................... 145
Security keys page ...................................................................... 145
Service location page .................................................................. 148
Users page ................................................................................ 148
Delayed Setup and Configuration page ........................................... 149
Intel AMT systems page ............................................................... 150
Profile assignments page ............................................................. 153
Resource Synchronization page .................................................... 154
Assign profile dialog box ........................................................ 155
Get ASF/DASH Configuration Inventory task .................................. 156
Update ASF Configuration Settings task ......................................... 156
Update DASH Configuration Settings task ...................................... 160
OOB Site Service page ................................................................. 161
Certificate Enrollment task .......................................................... 164
Firewall Configuration task .......................................................... 164
FQDN Synchronization task ......................................................... 165
Install Intel Setup and Configuration Server task ............................. 165
Install OOB Site Service agent task ................................................ 165
Install Out of Band Management Site Service Agent and Intel Setup
and Configuration Server job .................................................. 165
Intel Setup and Configuration Server Upgrade job ............................ 166
Intel Setup and Configuration Server Upgrade Job: internal task ......... 166
OOB Site Server Inventory task ..................................................... 166
Send Intel AMT Hello Message task ............................................... 166
Appendix A Troubleshooting Out of Band Management
Component ................................................................... 167
Viewing Intel SCS logs ................................................................. 167
About Intel SCS error messages ..................................................... 169
About Intel AMT setup and configuration issues .............................. 173
About Intel SCS console integration ............................................... 174
About Intel AMT filters update ..................................................... 174
Troubleshooting OOB site server installation ................................... 175
11Contents

Appendix B Reference topics ................................................................ 177
About passwords used with Intel AMT ............................................ 177
About populating filters ............................................................... 178
How Resource Synchronization policy works ................................... 181
Remote Configuration certificate requirements ................................ 182
Remote Configuration certificate –differences between releases ......... 182
Intel AMT Release 2.2 ............................................................ 183
Intel AMT Release 3.0 ............................................................ 183
Intel AMT Release 2.6 ............................................................ 183
Glossary ............................................................................................................. 185
Index ................................................................................................................... 189
Contents12

Introducing Out of Band
Management Component
This chapter includes the following topics:
■About Out of Band Management Component
■What’s new in Out of Band Management Component
■How Out of Band Management Component works
■What you can do with Out of Band Management Component
■Where to get more information
About Out of Band Management Component
Altiris Out of Band Management Component software (formerly known as Altiris
Out of Band Management Solution) lets you discover computers with ASF, DASH,
and Intel AMT in your environment and configure the computers for out-of-band
management.
Out-of-band management is the ability to manage client computers regardless of
the state of their power, operating system, or management agents. You can
remotely change the power state of the computer, collect hardware inventory,
and perform other management tasks that would normally require a visit to a
client computer.
See “About out-of-band management”on page 14.
1
Chapter

Figure 1-1 Out of Band Management Component features
About out-of-band management
Remote management of client computers often requires the managed computer
to be turned on with an operating system running. When a computer is turned
on with a running operating system, the computer is considered in-band.
Out-of-band is when a client computer is in one of the following out-of-band states:
■The computer is plugged in but is not actively running (off, standby,
hibernating).
■The operating system is not loaded (software or boot failure).
■The software-based management agent is not available.
Out-of-band management is the ability to manage computers in these states.
Computers with Intel AMT, ASF, DASH, or IPMI capabilities can be managed out
of band.
About supported out-of-band management technologies
Out of Band Management Component supports computers with the following
out-of-band management technologies:
Introducing Out of Band Management Component
About Out of Band Management Component
14

■Intel® Active Management Technology (Intel® AMT) 2.0 and later (also known
as Intel® vPro and Intel® Centrino® Pro technology)
See “About Intel AMT”on page 16.
■Broadcom ASF 2.0 and Intel ASF 2.0
See “About ASF”on page 24.
■Broadcom DASH
See “About DASH”on page 25.
Altiris products that can manage computers out of band
You can manage computers out of band using the following Altiris products:
■Altiris Real-Time Console Infrastructure
■Altiris Real-Time System Manager
These Altiris products let you perform the following out-of-band management
tasks:
■Turn on, turn off, or restart computers.
■Configure hardware alerts and change the alerts’destination address.
■Collect the hardware information that is stored in the NVRAM of the Intel
AMT device.
■Boot a computer from a remote disk or an image on a server and run the
operating system repair or reinstall.
■Start a remote control session from the Symantec Management Console and
access BIOS to view and change settings (Intel AMT only).
What’s new in Out of Band Management Component
In the 7.0 SP3 release of Out of Band Management Component, the following new
features are introduced:
■Support for Microsoft Windows 7.
You can install Out of Band Task Agent on the computers that are running
Microsoft Windows 7.
How Out of Band Management Component works
Out of Band Management Component installs Intel SCS on the Notification Server
computer and integrates it into the Symantec Management Console. From the
15Introducing Out of Band Management Component
What’s new in Out of Band Management Component

Symantec Management Console you can configure Intel SCS settings, discover
Intel AMT capable computers, and configure them for out-of-band management.
See “About the Symantec Management Console”on page 16.
Also, Out of Band Management Component provides you with the tools to discover
ASF and DASH capable computers and configure them for out-of-band
management.
You can manage configured Intel AMT, ASF, and DASH computers with Altiris
solutions that support out-of-band technologies.
See “Altiris products that can manage computers out of band”on page 15.
About the Symantec Management Console
The Symantec Management Console is the Web browser based administration
console for working with Symantec Management Platform and solutions, including
Out of Band Management Component. The console lets you perform tasks, schedule
events, run reports, perform configuration, configure security, and more. You can
run the console from the Notification Server computer (locally) or from a remote
computer with a network connection to Notification Server. This means that you
can perform administration tasks from wherever you are.
The console lets you set security that is specific to each console user. You specify
which areas of the console a user has access to and the rights that a user has to
perform specific actions. For example, one user can run reports while another
user can only view reports that have already been run.
You can start the console remotely by typing the following URL into the Internet
Explorer's address bar: http://<Notification_Server_name>/altiris/console
For more information on the console, see the Symantec Management Platform
Help, which can be accessed through the console's Help menu.
About Intel AMT
Intel Active Management Technology (Intel AMT) is a part of Intel vPro technology,
which provides the following technology capabilities:
Lets you remotely inventory, diagnose, and repair computers—even
those that are turned off —reducing costly desk-side visits and
increasing user uptime.
Remote manageability
Lets third-party security software identify more threats before
they reach the operating system. You can isolate infected systems
more quickly and update computers regardless of their power
state.
Security
Introducing Out of Band Management Component
How Out of Band Management Component works
16

Intel AMT is a solution that is based in hardware and firmware and is connected
to the system's auxiliary power plane. Despite the power state or the operating
system state of the client computer, Intel AMT provides IT administrators with
access to alerts, hardware inventory, power management, network filtering, and
agent presence functionality. Intel AMT functionality requires the computer to
be plugged into the power source and connected to the network. Intel AMT
functionality does not require a software agent to be installed on the client
computer.
Altiris Out of Band Management Component, Altiris Real-Time Console
Infrastructure, and Altiris Real-Time System Manager software support Intel
AMT 2.0 and later.
See “About configuring Intel AMT computers for out-of-band management”
on page 57.
See “About Intel AMT tasks”on page 26.
About Intel AMT Setup and Configuration Service
Intel AMT Setup and Configuration Service (Intel SCS) provides you with the tools
to set up and configure Intel AMT devices. Intel SCS is automatically installed on
the OOB site server computer (by default, the Notification Server computer).
See “About OOB site servers”on page 118.
Intel SCS installation creates a new database on the SQL server. This database
stores configuration parameters and administrative connection credentials for
each Intel AMT computer that you set up and configure with Out of Band
Management Component. Out of Band Management Component integrates Intel
SCS into the Symantec Management Platform and provides the interface for Intel
SCS in the Symantec Management Console.
About Intel AMT versions and features
Out of Band Management Component supports several versions of Intel AMT.
Table 1-1 Intel AMT versions and features
6.05.15.04.03.02.62.52.22.12.0Feature
D/NDDNDNNDDDesktop (D) or notebook (N) support
XXXXXXXXXXRemote platform (sw\hw) asset
tracking
XXXXXXXXXXRemote diagnostics and repair
17Introducing Out of Band Management Component
How Out of Band Management Component works

Table 1-1 Intel AMT versions and features (continued)
6.05.15.04.03.02.62.52.22.12.0Feature
XXXXXXXXXXAgent presence checking and alerting
XXXXXXXXXSystem isolation and recovery
XXXXXXXXXEnterprise mode with TLS\Kerberos
XXXXXXXXXUpgradeable remote firmware
XXXXXXXRemote configuration
X1 XXXWireless support (802.11i, VPN)
XXXXXXX802.1x native support
XXXXCIRA (Client Initiated Remote Access)
XXFull compliance to the DASH 1.0
standard
XKVM over IP
1Notebook computers only
About Intel AMT configuration modes
You can configure Intel AMT computers for out-of-band management in one of
the two modes:
■Small business mode
See “About Intel AMT small business mode”on page 18.
■Enterprise mode.
See “About Intel AMT enterprise mode”on page 19.
See “Comparison of Intel AMT small business and enterprise mode”on page 19.
About Intel AMT small business mode
Intel AMT small business configuration mode is easy to set up and is recommended
when you have a few Intel AMT computers. You can also use this mode if your
enterprise does not have DHCP or DNS services available or if using these services
is not allowed for security or other reasons.
This mode does not support Transport Layer Security (TLS), so communications
between computers are not encrypted. This mode works well in the environments
that do not have a security infrastructure. Because small business mode is designed
Introducing Out of Band Management Component
How Out of Band Management Component works
18

for small environments, this mode does not support communications across
subnets. If your environment incorporates subnets, use enterprise mode.
See “About TLS”on page 95.
See “About Intel AMT enterprise mode”on page 19.
If you are new to Intel AMT and want to evaluate the technology, you can configure
a few computers in small business mode. Small business mode lets you get things
set up and running more quickly. Setting up an Intel AMT computer in small
business mode is a manual process that is performed though the Intel AMT capable
computer’s BIOS. Out of Band Management Component is not involved in the
configuration process. After setup, the computer is ready to be managed out of
band.
See “Configuring Intel AMT computers in small business mode”on page 91.
About Intel AMT enterprise mode
Intel AMT enterprise configuration mode is designed to serve the needs of large
enterprises. When this mode is supported with the proper network infrastructure
services, it can provide automated (one-touch or remote) configuration for Intel
AMT devices. This mode also supports the configuration of wireless features on
the Intel AMT device and integration with Microsoft Active Directory.
This mode supports multiple security options: an Intel AMT access control list,
and the option to encrypt communications through the use of Transport Layer
Security (TLS).
See “About TLS”on page 95.
Use Out of Band Management Component to control the process of enterprise
mode Intel AMT configuration from the Symantec Management Console.
See “About configuring Intel AMT computers for out-of-band management”
on page 57.
Comparison of Intel AMT small business and enterprise mode
Intel AMT small business configuration mode is easy to set up and is recommended
when you have a few Intel AMT computers. Intel AMT enterprise configuration
mode is designed to serve the needs of large enterprises and is more secure.
See “About Intel AMT small business mode”on page 18.
See “About Intel AMT enterprise mode”on page 19.
19Introducing Out of Band Management Component
How Out of Band Management Component works

Table 1-2 Differences between Intel AMT small business and enterprise modes
Enterprise modeSmall-business modeFeature
Required and provided
through Intel SCS, which is
installed with the solution
Not neededSetup and configuration
application (Out of Band
Management Component)
Can be pre-set up from the
factory, implemented
through a USB key, or
manually through the MEBx
Must be set up through the
MEBx on the computer
Setup and configuration
Intel AMT 2.2, 2.6, 3.0, 4.0,
and 5.0 support zero-touch
remote configuration method
Not supportedRemote setup and
configuration
TLS encryption through use
of Microsoft certification
authority
Not supportedEncrypted communications
SupportedNot supportedMicrosoft Active Directory
integration
SupportedNot supportedWireless management
support
SupportedNot supportedNetwork subnet support
SupportedNot supportedAccess control list for
accessing Intel AMT
Centrally managed
passwords through the
management console
Must manually change
passwords on the computer
Intel AMT password support
About Intel AMT security
One of the key benefits of Intel AMT over other out-of-band technologies, such
as Wake on LAN, is the security features.
Introducing Out of Band Management Component
How Out of Band Management Component works
20